@openclaw/codex 2026.9.2 → 2026.9.3

package/dist/{runtime-artifact-Bh_gf6-t.js → runtime-artifact-T-NwqeSH.js}

@@ -1,11 +1,11 @@
-import { i as resolvePackagedCodexNativeCommand } from "./managed-binary-DcpnJF9x.js";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CzTngV0j.js";
+import { i as resolvePackagedCodexNativeCommand } from "./managed-binary-DrjjRRUD.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BGjHoYLr.js";
 import { createHash } from "node:crypto";
-import fs from "node:fs/promises";
+import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { constants } from "node:fs";
 import path from "node:path";
+import fs$1 from "node:fs/promises";
 import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
-import { constants } from "node:fs";
-import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 //#region extensions/codex/src/app-server/runtime-artifact.ts
 /** Exact local runtime artifact identity for verified Codex setup turns. */
 const ARTIFACT_ID_PREFIX = "codex-app-server:v1:";
@@ -66,9 +66,9 @@ function sameOpenedFile(left, right) {
 }
 async function readRegularFileFingerprint(params) {
 	throwIfAborted(params.signal);
-	if (!(await fs.lstat(params.filePath, { bigint: true })).isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
+	if (!(await fs$1.lstat(params.filePath, { bigint: true })).isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
 	const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0);
-	const handle = await fs.open(params.filePath, flags);
+	const handle = await fs$1.open(params.filePath, flags);
 	try {
 		const before = await handle.stat({ bigint: true });
 		if (!before.isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
@@ -86,7 +86,7 @@ async function readRegularFileFingerprint(params) {
 			offset += BigInt(bytesRead);
 		}
 		const after = await handle.stat({ bigint: true });
-		const current = await fs.stat(params.filePath, { bigint: true });
+		const current = await fs$1.stat(params.filePath, { bigint: true });
 		if (!sameOpenedFile(before, after) || !sameOpenedFile(after, current)) throw new Error(`Codex runtime artifact changed while reading: ${params.filePath}`);
 		params.budget.fileCount += 1;
 		params.budget.totalBytes += after.size;
@@ -105,7 +105,7 @@ async function listPackageFiles(params) {
 	const visit = async (directory, depth) => {
 		throwIfAborted(params.signal);
 		if (depth > MAX_ARTIFACT_DEPTH) throw new Error("Codex runtime artifact exceeds the bounded directory depth");
-		const entries = await fs.readdir(directory, {
+		const entries = await fs$1.readdir(directory, {
 			withFileTypes: true,
 			encoding: "utf8"
 		});
@@ -202,21 +202,21 @@ function attestNodeOptions(value) {
 }
 async function hashSelectedArtifactFiles(descriptor, signal) {
 	throwIfAborted(signal);
-	if (await fs.realpath(descriptor.commandPath) !== descriptor.commandRealPath) throw new Error("Codex runtime launcher selection changed");
+	if (await fs$1.realpath(descriptor.commandPath) !== descriptor.commandRealPath) throw new Error("Codex runtime launcher selection changed");
 	const packageRoot = descriptor.packageRoot;
 	if (await resolvePackageRoot(descriptor.nativePath) !== packageRoot) throw new Error("Codex runtime package selection changed");
-	if (packageRoot && await fs.realpath(packageRoot) !== packageRoot) throw new Error("Codex runtime package root changed");
+	if (packageRoot && await fs$1.realpath(packageRoot) !== packageRoot) throw new Error("Codex runtime package root changed");
 	const allFiles = [
 		descriptor.commandRealPath,
 		...descriptor.invocationPaths,
 		descriptor.nativePath,
 		...descriptor.codeModeHostPath ? [descriptor.codeModeHostPath] : []
 	];
-	for (const filePath of allFiles) if (await fs.realpath(filePath) !== filePath) throw new Error(`Codex runtime artifact file selection changed: ${filePath}`);
+	for (const filePath of allFiles) if (await fs$1.realpath(filePath) !== filePath) throw new Error(`Codex runtime artifact file selection changed: ${filePath}`);
 	if (descriptor.codeModeHostPath) {
-		if (await fs.realpath(descriptor.codeModeHostCandidatePath) !== descriptor.codeModeHostPath) throw new Error("Codex code-mode host selection changed");
+		if (await fs$1.realpath(descriptor.codeModeHostCandidatePath) !== descriptor.codeModeHostPath) throw new Error("Codex code-mode host selection changed");
 	} else try {
-		await fs.lstat(descriptor.codeModeHostCandidatePath);
+		await fs$1.lstat(descriptor.codeModeHostCandidatePath);
 		throw new Error("Codex code-mode host selection changed");
 	} catch (error) {
 		if (!isMissingPathError(error)) throw error;
@@ -283,7 +283,7 @@ async function resolveCommandPath(command, env, cwd) {
 			const entryPath = entry === "" ? cwd : path.isAbsolute(entry) ? entry : path.resolve(cwd, entry);
 			const possible = path.join(entryPath, command);
 			try {
-				await fs.access(possible, constants.X_OK);
+				await fs$1.access(possible, constants.X_OK);
 				candidate = possible;
 				break;
 			} catch {}
@@ -291,11 +291,11 @@ async function resolveCommandPath(command, env, cwd) {
 	}
 	if (!candidate) throw new Error(`Codex runtime launcher is unavailable: ${command}`);
 	const absolute = path.resolve(candidate);
-	if (!(await fs.stat(absolute)).isFile()) throw new Error(`Codex runtime launcher is not a regular file: ${absolute}`);
+	if (!(await fs$1.stat(absolute)).isFile()) throw new Error(`Codex runtime launcher is not a regular file: ${absolute}`);
 	return absolute;
 }
 async function readShebang(filePath) {
-	const handle = await fs.open(filePath, "r");
+	const handle = await fs$1.open(filePath, "r");
 	try {
 		const buffer = Buffer.alloc(4096);
 		const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
@@ -314,7 +314,7 @@ async function resolvePosixInvocationPaths(params) {
 	if (!shebang) return paths;
 	if (!params.nativeCommand) throw new Error("Codex runtime cannot attest a custom script launcher without its native target");
 	const interpreter = await resolveCommandPath(shebang[0], params.env, params.cwd);
-	paths.push(await fs.realpath(interpreter));
+	paths.push(await fs$1.realpath(interpreter));
 	if (path.basename(interpreter) !== "env") {
 		if (shebang.length !== 1) throw new Error("Codex runtime launcher uses unsupported interpreter arguments");
 		return paths;
@@ -324,7 +324,7 @@ async function resolvePosixInvocationPaths(params) {
 	const target = envArgs[commandIndex];
 	if (!target || target.startsWith("-") || envArgs.length !== commandIndex + 1) throw new Error("Codex runtime launcher uses unsupported env arguments");
 	const targetPath = await resolveCommandPath(target, params.env, params.cwd);
-	paths.push(await fs.realpath(targetPath));
+	paths.push(await fs$1.realpath(targetPath));
 	return paths;
 }
 async function resolvePackageRoot(nativePath) {
@@ -333,8 +333,8 @@ async function resolvePackageRoot(nativePath) {
 	const candidate = path.dirname(binDir);
 	const metadataPath = path.join(candidate, "codex-package.json");
 	try {
-		if (!(await fs.lstat(metadataPath)).isFile()) return;
-		const root = await fs.realpath(candidate);
+		if (!(await fs$1.lstat(metadataPath)).isFile()) return;
+		const root = await fs$1.realpath(candidate);
 		return isPathInside(root, nativePath) ? root : void 0;
 	} catch {
 		return;
@@ -342,8 +342,8 @@ async function resolvePackageRoot(nativePath) {
 }
 async function resolveOptionalRegularFile(filePath) {
 	try {
-		const canonical = await fs.realpath(filePath);
-		return (await fs.stat(canonical)).isFile() ? canonical : void 0;
+		const canonical = await fs$1.realpath(filePath);
+		return (await fs$1.stat(canonical)).isFile() ? canonical : void 0;
 	} catch {
 		return;
 	}
@@ -363,7 +363,7 @@ async function captureFilesystemDescriptor(params) {
 	assertSafeNodeOptions(env);
 	const spawnCwd = path.resolve(params.startOptions.cwd ?? process.cwd());
 	const commandPath = await resolveCommandPath(params.startOptions.command, env, spawnCwd);
-	const commandRealPath = await fs.realpath(commandPath);
+	const commandRealPath = await fs$1.realpath(commandPath);
 	let nativeCommand = params.spawnIdentity.nativeCommand;
 	let nativeCandidate = commandRealPath;
 	let invocationPaths;
@@ -376,7 +376,7 @@ async function captureFilesystemDescriptor(params) {
 			packageName: "@openai/codex"
 		});
 		const entrypoint = program.leadingArgv[0];
-		if (program.resolution === "node-entrypoint" && entrypoint && !nativeCommand) nativeCommand = resolvePackagedCodexNativeCommand(await fs.realpath(entrypoint));
+		if (program.resolution === "node-entrypoint" && entrypoint && !nativeCommand) nativeCommand = resolvePackagedCodexNativeCommand(await fs$1.realpath(entrypoint));
 		if (program.resolution === "node-entrypoint" && !nativeCommand) throw new Error("Codex runtime cannot attest a custom Node launcher without its native target");
 		nativeCandidate = program.command;
 		const invocationCandidates = [
@@ -387,7 +387,7 @@ async function captureFilesystemDescriptor(params) {
 		invocationPaths = [];
 		for (const candidate of invocationCandidates) {
 			const resolved = await resolveCommandPath(candidate, env, spawnCwd);
-			invocationPaths.push(await fs.realpath(resolved));
+			invocationPaths.push(await fs$1.realpath(resolved));
 		}
 	} else {
 		nativeCommand ??= resolvePackagedCodexNativeCommand(commandRealPath);
@@ -400,7 +400,7 @@ async function captureFilesystemDescriptor(params) {
 	}
 	invocationPaths = [...new Set(invocationPaths)].toSorted(compareArtifactNames);
 	if (invocationPaths.length > MAX_ARTIFACT_INVOCATION_PATHS) throw new Error("Codex runtime launcher exceeds the bounded invocation file count");
-	const nativePath = await fs.realpath(await resolveCommandPath(nativeCommand ?? nativeCandidate, env, spawnCwd));
+	const nativePath = await fs$1.realpath(await resolveCommandPath(nativeCommand ?? nativeCandidate, env, spawnCwd));
 	const packageRoot = await resolvePackageRoot(nativePath);
 	const configuredCodeModeHost = readEffectiveSpawnEnvironmentValue(env, CODE_MODE_HOST_PATH_ENV)?.trim();
 	const adjacentCodeModeHost = path.join(path.dirname(nativePath), process.platform === "win32" ? "codex-code-mode-host.exe" : "codex-code-mode-host");

package/dist/sandbox-guard-BcT66fWy.js

@@ -0,0 +1,165 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { y as isCodexRemoteExecPlacementSandbox } from "./protocol-CAAcVIKF.js";
+import { n as resolveCodexNativeExecutionPolicy, t as formatCodexNativeNodeExecBlock } from "./native-execution-policy-umd0tgh4.js";
+import { tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/codex/src/app-server/sandbox-guard.ts
+/**
+* Blocks direct Codex app-server requests that would bypass OpenClaw sandbox or
+* node-exec routing guarantees.
+*/
+var sandbox_guard_exports = /* @__PURE__ */ __exportAll({
+	resolveCodexAppServerDirectSandboxBypassBlock: () => resolveCodexAppServerDirectSandboxBypassBlock,
+	resolveCodexNativeExecutionBlock: () => resolveCodexNativeExecutionBlock,
+	resolveCodexNativeSandboxBlock: () => resolveCodexNativeSandboxBlock
+});
+const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
+	["account/rateLimits/read", "allowed-control-plane"],
+	["account/read", "allowed-control-plane"],
+	["app/installed", "allowed-control-plane"],
+	["app/list", "allowed-control-plane"],
+	["app/read", "allowed-control-plane"],
+	["config/batchWrite", "allowed-control-plane"],
+	["config/mcpServer/reload", "allowed-control-plane"],
+	["config/read", "allowed-control-plane"],
+	["config/value/write", "allowed-control-plane"],
+	["environment/add", "allowed-control-plane"],
+	["experimentalFeature/enablement/set", "allowed-control-plane"],
+	["feedback/upload", "allowed-control-plane"],
+	["hooks/list", "allowed-control-plane"],
+	["initialize", "allowed-control-plane"],
+	["marketplace/add", "allowed-control-plane"],
+	["mcpServerStatus/list", "allowed-control-plane"],
+	["model/list", "allowed-control-plane"],
+	["plugin/install", "allowed-control-plane"],
+	["plugin/installed", "allowed-control-plane"],
+	["plugin/list", "allowed-control-plane"],
+	["plugin/read", "allowed-control-plane"],
+	["skills/list", "allowed-control-plane"],
+	["thread/archive", "allowed-control-plane"],
+	["thread/inject_items", "allowed-control-plane"],
+	["thread/list", "allowed-control-plane"],
+	["thread/metadata/update", "allowed-control-plane"],
+	["thread/name/set", "allowed-control-plane"],
+	["thread/read", "allowed-control-plane"],
+	["thread/rollback", "allowed-control-plane"],
+	["thread/start", "requires-openclaw-environment"],
+	["thread/unarchive", "allowed-control-plane"],
+	["thread/unsubscribe", "allowed-control-plane"],
+	["turn/interrupt", "allowed-control-plane"],
+	["turn/steer", "allowed-control-plane"],
+	["command/exec", "blocked-native-bypass"],
+	["command/resize", "blocked-native-bypass"],
+	["command/terminate", "blocked-native-bypass"],
+	["command/write", "blocked-native-bypass"],
+	["fuzzyFileSearch", "blocked-native-bypass"],
+	["mcpServer/resource/read", "blocked-native-bypass"],
+	["mcpServer/tool/call", "blocked-native-bypass"],
+	["process/kill", "blocked-native-bypass"],
+	["process/resizePty", "blocked-native-bypass"],
+	["process/spawn", "blocked-native-bypass"],
+	["process/writeStdin", "blocked-native-bypass"],
+	["review/start", "blocked-native-bypass"],
+	["thread/compact/start", "blocked-native-bypass"],
+	["thread/fork", "blocked-native-bypass"],
+	["thread/resume", "blocked-native-bypass"],
+	["thread/shellCommand", "blocked-native-bypass"],
+	["turn/start", "blocked-native-bypass"]
+]);
+const BLOCKED_DIRECT_METHOD_PREFIXES = [
+	"command/",
+	"fs/",
+	"windowsSandbox/"
+];
+const NODE_EXEC_BLOCKED_CONTROL_PLANE_METHODS = /* @__PURE__ */ new Set(["config/mcpServer/reload"]);
+/** Returns a block message when a direct app-server method would bypass OpenClaw execution policy. */
+function resolveCodexAppServerDirectSandboxBypassBlock(params) {
+	const policy = resolveDirectMethodPolicy(params.method);
+	if (NODE_EXEC_BLOCKED_CONTROL_PLANE_METHODS.has(params.method)) {
+		const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+			config: params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.sessionId,
+			surface: `app-server method \`${params.method}\``
+		});
+		if (nodeExecBlock) return nodeExecBlock;
+	}
+	if (policy === "allowed-control-plane") return;
+	const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+		config: params.config,
+		sessionKey: params.sessionKey,
+		sessionId: params.sessionId,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (nodeExecBlock) return nodeExecBlock;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	const sandboxBlock = resolveCodexNativeSandboxBlock({
+		config: params.config,
+		sessionKey,
+		sandbox: params.sandbox,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (!sandboxBlock) return;
+	if (policy === "requires-openclaw-environment" && hasOpenClawSandboxEnvironmentSelection(params.requestParams)) return;
+	return sandboxBlock;
+}
+/** Resolves the generic native-execution block for sandboxed or node-hosted sessions. */
+function resolveCodexNativeExecutionBlock(params) {
+	return resolveCodexNativeSandboxBlock(params) ?? resolveCodexNativeNodeExecBlock(params);
+}
+/** Returns a block message when native Codex execution cannot honor active sandboxing. */
+function resolveCodexNativeSandboxBlock(params) {
+	if (params.sandboxEnvironmentSelected) return;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? params.agentId ?? tryResolveDefaultAgentId(params.config ?? {});
+	if (!sandboxAgentId) return;
+	if (!resolveSandboxRuntimeStatus({
+		cfg: params.config,
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
+	}).sandboxed) return;
+	return formatCodexNativeSandboxBlock({ surface: params.surface });
+}
+function resolveDirectMethodPolicy(method) {
+	const exact = DIRECT_METHOD_POLICIES.get(method);
+	if (exact) return exact;
+	if (BLOCKED_DIRECT_METHOD_PREFIXES.some((prefix) => method.startsWith(prefix))) return "blocked-native-bypass";
+	return "blocked-native-bypass";
+}
+function hasOpenClawSandboxEnvironmentSelection(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const environments = value.environments;
+	return Array.isArray(environments) && environments.length > 0 && environments.every((entry) => {
+		if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+		const environment = entry;
+		return typeof environment.environmentId === "string" && environment.environmentId.startsWith("openclaw-sandbox-") && typeof environment.cwd === "string" && environment.cwd.trim().length > 0;
+	});
+}
+function formatCodexNativeSandboxBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw sandboxing is active for this session.`,
+		"This mode cannot route execution through the OpenClaw sandbox backend.",
+		"Use a normal Codex harness turn, or run an intentionally unsandboxed session."
+	].join(" ");
+}
+function resolveCodexNativeNodeExecBlock(params) {
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	const policy = resolveCodexNativeExecutionPolicy({
+		config: params.config,
+		sessionKey,
+		agentId: params.agentId,
+		readRuntimeSessionEntry: Boolean(sessionKey)
+	});
+	if (policy.nativeToolSurfaceAllowed) return;
+	return formatCodexNativeNodeExecBlock({
+		surface: params.surface,
+		reason: policy.blockReason
+	});
+}
+//#endregion
+export { resolveCodexNativeSandboxBlock as n, sandbox_guard_exports as r, resolveCodexNativeExecutionBlock as t };

package/dist/{session-binding-4Ki04sW-.js → session-binding-CKSepwIC.js}

@@ -1,12 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { g as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN } from "./config-utils-C57JiJrU.js";
-import { a as readCodexBindingTimestamp, c as readStoredCodexAppServerBinding, d as validateBindingForWrite, i as readCodexBindingSessionEntry, l as sessionBindingIdentity, n as ownsStoredSessionGeneration, o as readCodexSessionOwnershipBinding, r as readCodexAppServerThreadBinding, s as readCurrentCodexAppServerBinding, t as bindingStoreKey, u as stripUndefinedBinding } from "./session-binding-record-CyaXZvTe.js";
+import { a as readCodexAppServerThreadBinding, c as readStoredCodexAppServerBinding, d as validateBindingForWrite, i as ownsStoredSessionGeneration, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as readCodexBindingTimestamp, r as bindingStoreKey, s as readCurrentCodexAppServerBinding, t as CodexSupervisionBindingReplacementError, u as stripUndefinedBinding } from "./session-binding-record-CaZjYwNS.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
+import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CwzO4_RG.js";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
-import { AgentHarnessPreflightError, AgentHarnessSessionSupersededError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { isDeepStrictEqual } from "node:util";
-import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
+import { AgentHarnessSessionSupersededError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region extensions/codex/src/app-server/session-binding.ts
 /** SQLite-backed Codex app-server thread bindings. */
@@ -21,8 +22,6 @@ var session_binding_exports = /* @__PURE__ */ __exportAll({
 	createCodexSessionGenerationSupersededError: () => createCodexSessionGenerationSupersededError,
 	createStoredCodexAppServerBinding: () => createStoredCodexAppServerBinding,
 	hashCodexAppServerBindingFingerprint: () => hashCodexAppServerBindingFingerprint,
-	isCodexAppServerNativeAuthProfile: () => isCodexAppServerNativeAuthProfile,
-	normalizeCodexAppServerBindingModelProvider: () => normalizeCodexAppServerBindingModelProvider,
 	normalizeStoredCodexAppServerBindingFingerprints: () => normalizeStoredCodexAppServerBindingFingerprints,
 	readCodexAppServerThreadBinding: () => readCodexAppServerThreadBinding,
 	readStoredCodexAppServerBinding: () => readStoredCodexAppServerBinding,
@@ -33,8 +32,6 @@ var session_binding_exports = /* @__PURE__ */ __exportAll({
 	sessionBindingIdentity: () => sessionBindingIdentity,
 	validateBindingForWrite: () => validateBindingForWrite
 });
-const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai";
-const PUBLIC_OPENAI_MODEL_PROVIDER = "openai";
 const BINDING_LEASE_RETRY_INTERVAL_MS = 1e3;
 const BOUNDED_BINDING_FINGERPRINT_PATTERN = /^sha256:[a-f0-9]{64}$/i;
 const CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS = 6e4;
@@ -46,6 +43,30 @@ const PHYSICAL_SESSION_RETIRE_TTL_MS = BINDING_LEASE_WAIT_MS;
 function resolveCodexRunSessionBindingAuthority(params) {
 	return captureCodexSessionGenerationAuthority(params)[0];
 }
+/** Host lineage is recorded in the same transaction as its successor generation. */
+function readCodexBindingSessionEntry(params) {
+	const { identity } = params;
+	return identity.sessionKey?.trim() ? getSessionEntry({
+		agentId: identity.agentId,
+		sessionKey: identity.sessionKey.trim(),
+		storePath: params.storePath?.trim() || resolveStorePath(params.config?.session?.store, { agentId: identity.agentId }),
+		hydrateSkillPromptRefs: false,
+		readConsistency: "latest"
+	}) : void 0;
+}
+/** Synchronous model selection recognizes the predecessor; admission rewrites its fence. */
+function readCodexSessionOwnershipBinding(params) {
+	const binding = params.bindingStore.read(params.identity);
+	if (binding || params.identity.kind !== "session") return binding;
+	const entry = readCodexBindingSessionEntry({
+		...params,
+		identity: params.identity
+	});
+	return entry?.sessionId === params.identity.sessionId && entry.previousSessionId ? params.bindingStore.read({
+		...params.identity,
+		sessionId: entry.previousSessionId
+	}) : void 0;
+}
 function captureCodexSessionGenerationAuthority(params, assertCallerCurrent = () => {}) {
 	const readEntry = () => {
 		try {
@@ -78,16 +99,6 @@ function captureCodexSessionGenerationAuthority(params, assertCallerCurrent = ()
 function createCodexSessionGenerationSupersededError(sessionId) {
 	return new AgentHarnessSessionSupersededError(`Codex session generation is no longer current: ${sessionId}`);
 }
-var CodexSupervisionBindingReplacementError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Refusing to replace supervised Codex thread ${threadId} while ${operation}; its native user-home connection and model ownership must be preserved`);
-		this.name = "CodexSupervisionBindingReplacementError";
-	}
-};
-function assertCodexBindingMayBeReplaced(binding, operation, expected) {
-	if (expected) throw new AgentHarnessPreflightError(`Codex native model ownership prevents ${operation}. Continue or compact the original session in its native runtime, or create a new chat with a concrete model; the original binding was preserved.`);
-	if (binding?.connectionScope === "supervision") throw new CodexSupervisionBindingReplacementError(binding.threadId, operation);
-}
 function hashCodexAppServerBindingFingerprint(canonical) {
 	return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
 }
@@ -724,34 +735,5 @@ function sleep(ms) {
 		setTimeout(resolve, ms);
 	});
 }
-/** Returns true when an auth profile uses native Codex/OpenAI app-server auth. */
-function isCodexAppServerNativeAuthProfile(lookup) {
-	const authProfileId = lookup.authProfileId?.trim();
-	if (!authProfileId) return false;
-	try {
-		const credential = (lookup.authProfileStore ?? ensureAuthProfileStore(lookup.agentDir?.trim() || resolveDefaultAgentDir(lookup.config ?? {}), {
-			allowKeychainPrompt: false,
-			config: lookup.config,
-			externalCliProviderIds: [CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER],
-			externalCliProfileIds: [authProfileId]
-		})).profiles[authProfileId];
-		if (!credential || credential.type === "api_key") return false;
-		const provider = credential.provider?.trim();
-		return Boolean(provider && resolveProviderIdForAuth(provider, { config: lookup.config }) === CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER);
-	} catch (error) {
-		embeddedAgentLog.debug("failed to resolve codex app-server auth profile provider", {
-			authProfileId,
-			error
-		});
-		return false;
-	}
-}
-/** Hides redundant OpenAI provider attribution for native Codex auth bindings. */
-function normalizeCodexAppServerBindingModelProvider(params) {
-	const modelProvider = params.modelProvider?.trim();
-	if (!modelProvider) return;
-	if (isCodexAppServerNativeAuthProfile(params) && modelProvider.toLowerCase() === PUBLIC_OPENAI_MODEL_PROVIDER) return;
-	return modelProvider;
-}
 //#endregion
-export { isCodexAppServerNativeAuthProfile as a, resolveCodexRunSessionBindingAuthority as c, session_binding_exports as d, hashCodexAppServerBindingFingerprint as i, resolveCodexSessionBinding as l, assertCodexBindingMayBeReplaced as n, normalizeCodexAppServerBindingModelProvider as o, createCodexSessionGenerationSupersededError as r, reclaimCurrentCodexSessionGeneration as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, scopeCodexRunBindingStore as u };
+export { resolveCodexRunSessionBindingAuthority as a, session_binding_exports as c, reclaimCurrentCodexSessionGeneration as i, createCodexSessionGenerationSupersededError as n, resolveCodexSessionBinding as o, hashCodexAppServerBindingFingerprint as r, scopeCodexRunBindingStore as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t };

package/dist/{session-binding-record-CyaXZvTe.js → session-binding-record-CaZjYwNS.js}

@@ -1,7 +1,7 @@
 import { g as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN, i as normalizeCodexServiceTier } from "./config-utils-C57JiJrU.js";
 import { createHash } from "node:crypto";
+import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
-import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { z } from "zod";
 //#region extensions/codex/src/app-server/session-binding-record.ts
 /** Canonical binding codec and synchronous generation-aware reads; no lifecycle or auth loading. */
@@ -242,29 +242,15 @@ function readCurrentCodexAppServerBinding(state, identity) {
 	if (raw !== void 0 && !stored) throw new Error(`Invalid Codex app-server binding row: ${key}`);
 	return stored?.state === "active" && ownsStoredSessionGeneration(identity, stored) ? stored.binding : void 0;
 }
-/** Host lineage is recorded in the same transaction as its successor generation. */
-function readCodexBindingSessionEntry(params) {
-	const { identity } = params;
-	return identity.sessionKey?.trim() ? getSessionEntry({
-		agentId: identity.agentId,
-		sessionKey: identity.sessionKey.trim(),
-		storePath: params.storePath?.trim() || resolveStorePath(params.config?.session?.store, { agentId: identity.agentId }),
-		hydrateSkillPromptRefs: false,
-		readConsistency: "latest"
-	}) : void 0;
-}
-/** Synchronous model selection recognizes the predecessor; admission rewrites its fence. */
-function readCodexSessionOwnershipBinding(params) {
-	const binding = params.bindingStore.read(params.identity);
-	if (binding || params.identity.kind !== "session") return binding;
-	const entry = readCodexBindingSessionEntry({
-		...params,
-		identity: params.identity
-	});
-	return entry?.sessionId === params.identity.sessionId && entry.previousSessionId ? params.bindingStore.read({
-		...params.identity,
-		sessionId: entry.previousSessionId
-	}) : void 0;
+var CodexSupervisionBindingReplacementError = class extends Error {
+	constructor(threadId, operation) {
+		super(`Refusing to replace supervised Codex thread ${threadId} while ${operation}; its native user-home connection and model ownership must be preserved`);
+		this.name = "CodexSupervisionBindingReplacementError";
+	}
+};
+function assertCodexBindingMayBeReplaced(binding, operation, expected) {
+	if (expected) throw new AgentHarnessPreflightError(`Codex native model ownership prevents ${operation}. Continue or compact the original session in its native runtime, or create a new chat with a concrete model; the original binding was preserved.`);
+	if (binding?.connectionScope === "supervision") throw new CodexSupervisionBindingReplacementError(binding.threadId, operation);
 }
 //#endregion
-export { readCodexBindingTimestamp as a, readStoredCodexAppServerBinding as c, validateBindingForWrite as d, readCodexBindingSessionEntry as i, sessionBindingIdentity as l, ownsStoredSessionGeneration as n, readCodexSessionOwnershipBinding as o, readCodexAppServerThreadBinding as r, readCurrentCodexAppServerBinding as s, bindingStoreKey as t, stripUndefinedBinding as u };
+export { readCodexAppServerThreadBinding as a, readStoredCodexAppServerBinding as c, validateBindingForWrite as d, ownsStoredSessionGeneration as i, sessionBindingIdentity as l, assertCodexBindingMayBeReplaced as n, readCodexBindingTimestamp as o, bindingStoreKey as r, readCurrentCodexAppServerBinding as s, CodexSupervisionBindingReplacementError as t, stripUndefinedBinding as u };